1667680 - [warp] Assertion failure: script->length() <= JitOptions.ionMaxScriptSize, at jit/TrialInlining.cpp:42

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect, P1)

Description

[Gary Kwong [:gkw] [:nth10sd] (NOT official MoCo now)]

Attachment: testcase

See attached testcase.

(gdb) bt
#0  0x0000555557dc25ca in js::jit::DoTrialInlining (cx=0x7ffff6927000, frame=0x7fffffffb550) at /home/skygentoo/trees/mozilla-central/js/src/jit/TrialInlining.cpp:42
#1  0x000030b3aaeb4c35 in ?? ()
#2  0x00001f1b946771f0 in ?? ()
#3  0x00007fffffffb528 in ?? ()
#4  0x0000000000000008 in ?? ()
#5  0x0000555558d3ea10 in js::jit::vmFunctions ()
#6  0x000030b3aaf72107 in ?? ()
#7  0x0000000000006021 in ?? ()
#8  0x00007fffffffb550 in ?? ()
#9  0xfffe313f74700828 in ?? ()
#10 0x0000000000000000 in ?? ()
(gdb)

The first bad revision is:
changeset:   https://hg.mozilla.org/mozilla-central/rev/f5f7119a80ac
user:        Jan de Mooij
date:        Wed Sep 16 11:15:42 2020 +0000
summary:     Bug 1664786 part 6 - Limit total bytecode size when trial inlining. r=iain

Run with --fuzzing-safe --no-threads --fast-warmup --warp --ion-limit-script-size=off, compile with AR=ar sh ./configure --enable-debug --with-ccache --enable-gczeal --enable-debug-symbols --disable-tests, tested on m-c rev cb8232ebe212.

I doubt this is s-s but I'll let Jan/other devs make the decision.

Comment 1

[Jan de Mooij [:jandem]]

A bogus assertion. Some limits don't apply with --ion-limit-script-size=off (a testing configuration) so the code shouldn't assume they're there.

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Bug 1667680 - Fix assertion to account for --ion-limit-script-size=off testing flag. r?iain!

Comment 3

[BugBot [:suhaib / :marco/ :calixte]]

Set release status flags based on info from the regressing bug 1664786

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/8e4778c34026
Fix assertion to account for --ion-limit-script-size=off testing flag. r=iain

Comment 5

[Cristian Brindusan [:cbrindusan]]

https://hg.mozilla.org/mozilla-central/rev/8e4778c34026

Comment 6

[Alexandru Ionescu (needinfo me) [:alexandrui]]

== Change summary for alert #27122 (as of Sat, 03 Oct 2020 03:28:54 GMT) ==

Improvements:

4% build times linux64 debug base-toolchains-clang taskcluster-m5.4xlarge 1,499.33 -> 1,442.72

For up to date results, see: https://treeherder.mozilla.org/perf.html#/alerts?id=27122